CVE-2026-64847
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In AnyIO prior to 4.14.2, process-pool workers were started with stderr connected to a pipe the parent never drained. Worker code writing enough data to sys.stderr could fill the pipe and block before returning the response, causing the awaiting process-pool call to remain blocked indefinitely.
Risk Assessment
Applications running untrusted or faulty worker code may experience permanent hangs of process-pool operations, leading to denial of service.
Recommendation
Upgrade AnyIO to version 4.14.2 or later, which properly handles worker standard streams.
Other vulnerabilities in AnyIO
See all- CVE-2026-63349High
In AnyIO 4.14.0, open_process() forwards the group argument to the backend instead of extra_groups, despite accepting the extra_groups parameter. A call with extra_groups=[] to clear inherited supplementary groups can launch a child process that retains the parent's groups, weakening a privilege-dropping boundary. This affects POSIX applications using AnyIO subprocess helpers and is fixed in version 4.14.2.
- CVE-2026-63374Critical
AnyIO's TLS connections to internationalized (non-ASCII) domain names may be vulnerable if the connection is hijacked and redirected to a malicious server, potentially allowing man-in-the-middle attacks.
Original NVD description (English source)
AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains, even though the documented behavior redirects all three standard streams. Worker code that writes enough attacker-influenced data to sys.stderr can fill the pipe and block before returning the standard-output protocol response, causing the awaiting process-pool call to remain blocked indefinitely. Applications that run untrusted or faulty worker code capable of producing substantial standard-error output are affected. This issue is fixed in version 4.14.2.